upstream/bind9
1
0
Fork 0
mirror of https://github.com/isc-projects/bind9.git synced 2026-06-15 02:10:00 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

Ignore NSEC records without RRSIG and NSEC present

Browse source 
dns_nsec_noexistnodata now checks that RRSIG and NSEC are
present in the type map.  Both types should be present in
a correctly constructed NSEC record.  This check is in
addition to similar checks in resolver.c and validator.c.
This commit is contained in:
Mark Andrews 2021-11-06 09:30:48 +11:00 committed by Petr Špaček
parent 8ff2c133b5
commit 4bdd5a9953
No known key found for this signature in database
GPG key ID: ABD587CDF06581AE
2 changed files with 18 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
lib/dns/nsec.c
View file

@ -328,6 +328,16 @@ dns_nsec_noexistnodata(dns_rdatatype_t type, const dns_name_t *name,
}
dns_rdataset_current(nsecset, &rdata);
#ifdef notyet
if (!dns_nsec_typepresent(&rdata, dns_rdatatype_rrsig) ||
!dns_nsec_typepresent(&rdata, dns_rdatatype_nsec))
{
(*logit)(arg, ISC_LOG_DEBUG(3),
"NSEC missing RRSIG and/or NSEC from type map");
return (ISC_R_IGNORE);
}
#endif
(*logit)(arg, ISC_LOG_DEBUG(3), "looking for relevant NSEC");
relation = dns_name_fullcompare(name, nsecname, &order, &olabels);

8
lib/ns/query.c
View file

@ -10069,6 +10069,14 @@ query_coveringnsec(query_ctx_t *qctx) {
goto cleanup;
}
/*
* If NSEC or RRSIG are missing from the type map
* reject the NSEC RRset.
*/
if (!dns_nsec_requiredtypespresent(qctx->rdataset)) {
goto cleanup;
}
/*
* Check that we have the correct NOQNAME NSEC record.
*/